The "email is authentication" pattern
rubenerd.com
The "email is authentication" pattern
1–10 of 474 posts
Re: The "email is authentication" pattern
#2People have already been building auth flows that take this password amnesia into consideration. Look at Anthropic. It's just one way of doing auth and I personally hate it.
Re: The "email is authentication" pattern
#3Email accounts are the highest common denominator in online authentication. Phones are competitive, but people lose phones. Phone numbers are more common and durable, but the security of phone numbers is leagues below that of a flagship provider email account. It makes sense that so many authentication flows work this way.
When designing a "fantasy football" alternate authentication system for the Internet, start with account recovery: what happens when a user loses your fancy authenticator? If the answer is "they just don't get access anymore" or "a panel of their peers attests to them", your fantasy authentication system also needs a fantasy species of sentient beings to serve as users, because it won't work for humans.
Re: The "email is authentication" pattern
#4I never thought of using password reset as a permanent authentication method. Ingenious!
Except when the service throws you back to the login page to authenticate with a fresh password you just typed in the reset form.
Re: The "email is authentication" pattern
#5As long as the email account is secure, and the throw-away one-time passwords are good, you have the frequent-rotation passwords security advocates dream about. Indeed, hand them a secure password they have to use (and forget).
Re: The "email is authentication" pattern
#6“It offers a guaranteed, repeatable, low-effort solution”
Doesn’t this answer the question? I would have preferred to read and discuss what they believe to be better alternatives.
Re: The "email is authentication" pattern
#7You posit a good question but it would be interesting to take a step further and discuss some potential alternatives, or expand on why "email is authentication" is/isn't the best option there is.
Re: The "email is authentication" pattern
#8I’ll be hyperbolic and say the login flow is identical.
A) Go to website, click through a password manager to copy and paste an arbitrary string of characters, receive TOTP request sent to your email to confirm your identity.
Or
B) Go to website, click forgot my password. Receive link to login. Enter an arbitrary string of characters.
In many instances, login flow B is actually quicker and seldom slower.
Clicking the “remember me” checkbox has no effect.
Re: The "email is authentication" pattern
#9Somewhat related discussion from yesterday: https://news.ycombinator.com/item?id=41468486
Re: The "email is authentication" pattern
#10I never thought of using password reset as a permanent authentication method. Ingenious! Except when the service throws you back to the login page to authenticate with a fresh password you just typed in the reset form.
Plenty of services do this already, right? It's called "Magic link" login. Am I missing a subtlety?